What is CSRF?
Tricking a victim's browser into sending authenticated requests.
Cross-Site Request Forgery — an attacker's page makes the victim's browser silently submit a request to another site where they're still logged in, abusing ambient cookie auth. Defenses: CSRF tokens, SameSite cookies and verifying Origin headers.